Subject: breaktrough nodirs

From: Emil Isberg <[email-masked]>
Date: Wed, 19 Mar 1997 14:47:25 +0100 (MET)

Hello, I think it may be some fault with our configuration, because I have
set it up to only accept uploads in /incoming and not accept creation of
dirs in that dir ..
but as you see from the xferlog someone managed to get past it.
(sorry about the format .. pine you know)

Tue Mar 18 14:29:57 1997 1 u70.gymnasium.tyreso.se 475
/incoming/1/00index.txt b _ i a guest ftp 0 *
Tue Mar 18 14:41:56 1997 1 u63.gymnasium.tyreso.se 475
/incoming/1/00index.txt b _ o a [email-masked] ftp 0 *
Tue Mar 18 14:42:00 1997 1 u63.gymnasium.tyreso.se 475
/incoming/1/00index.txt a _ o a [email-masked] ftp 0 *
Tue Mar 18 14:42:01 1997 105 u70.gymnasium.tyreso.se 1463422
/incoming/old/.../games/Red_alert/redalert.001 b _ i a guest ftp 0 *
Tue Mar 18 14:43:59 1997 74 u70.gymnasium.tyreso.se 1463259
/incoming/old/.../games/Red_alert/redalert.002 b _ i a guest ftp 0 *

here is the stuff from ftpaccess
(I run wu-2.4.2-academ[BETA-12] with in.ftpd -u022 -a -l)

# specify the upload directory information
upload  /home/ftp  *             no
upload 	/home/ftp	/incoming	yes     adm	ftpadmin	0060 nodirs
#this work .. but then we need some .lsm so that adm know where to put the files ..

upload  /home/ftp  /bin          no
upload  /home/ftp  /etc          no
upload  /home/ftp  /usr          no
upload  /home/ftp  /dev          no
#just some defaults .. shouldn't be needed  .. but got them just in case ..

noretrieve /etc/passwd /etc/shadow core

(I attach the file for those of you that want to see the rest of it)

/Emil
banner /etc/ftpd/msgs/banner

class   mdsrealusers   real	*.mds.mdh.se mds.mdh.se legolas legolas.mdh.se
class   mdhrealusers   real	*.mdh.se 130.238.* 194.17.28.15
class   otherealrusers real	*
#class	ftp	anonymous,guest	*
class   ftpmds	anonymous,guest	*.mds.mdh.se mds.mdh.se legolas legolas.mdh.se
class   ftpmdh	anonymous,guest	*.mdh.se 130.238.* 194.17.28.15
class   ftpother anonymous,guest	*

limit otherusers 20     Any     /etc/ftpd/msgs/msg.full
limit ftpmdh	20	Any	/etc/ftpd/msgs/msg.full
limit ftpother	10	Any	/etc/ftpd/msgs/msg.full
limit all	100	Any	/etc/ftpd/msgs/msg.dead
#limit	other	50	Any	/etc/ftpd/msgs/msg.dead
#limit	ftp	10	Any	/home/ftp/etc/msgs/msg.toomany

readme	README*    login
readme	README*    cwd=*

message /welcome.msg            login
message .message                login
message .message                cwd=*
message .contents               login
message .contents               cwd=*

#compress        yes             local remote
#tar             yes             local remote
#compress        yes             ftp
#tar             yes             ftp

log commands anonymous,guest
log transfers real,anonymous,guest inbound,outbound
#log transfers anonymous inbound,outbound

loginfails	3
#path-filter	anonymous	/etc/ftpd/msgs/pathmsg	^[-A-Za-z0-9._]*$	^. ^-
#path-filter	guest		/etc/ftpd/msgs/pathmsg	^[-A-Za-z0-9._]*$	^. ^-
#path-filter	anonymous	/etc/ftpd/msgs/pathmsg	^[-A-Za-z0-9\._]*$	^\. ^-
#something wrong with the path-filters .. checking later ..

# all the following default to "yes" for everybody
delete		no	guest,anonymous		# delete permission?
#overwrite	no	guest,anonymous		# overwrite permission?
rename		no	guest,anonymous		# rename permission?
chmod		no	anonymous		# chmod permission?
umask		no	anonymous		# umask permission?

# specify the upload directory information
upload  /home/ftp  *             no
upload 	/home/ftp	/incoming	yes     adm	ftpadmin	0060 nodirs
#this work .. but then we need some .lsm so that adm no where to put the files ..

#upload 	/home/ftp	/incoming	yes     adm	ftpadmin	0060 dirs
#upload 	/home/ftp	/incoming/*	yes     adm	ftpadmin	0060 nodirs
#does not work .. the dirs get the wrong owners .. could patch wu-ftpd .. :-(

upload  /home/ftp  /bin          no
upload  /home/ftp  /etc          no
upload  /home/ftp  /usr          no
upload  /home/ftp  /dev          no
#just some defaults .. shouldn't be needed  .. but got them just in case ..

noretrieve /etc/passwd /etc/shadow core

shutdown /etc/ftpshutmsg
#this file should be a link to /etc/ftpd/msgs/ftpshutmsg ..
# and /etc/ftpd/msgs/ftpshutmsg is a link to /home/ftp/etc/shutmsg
#  that file shouldn't be there .. but the softlinks shall be there :-)

email [email-masked]
#just some defaults .. should work ..

---

From: Alain Magloire <[email-masked]>
Date: Wed, 19 Mar 1997 11:00:10 -0500 (EST)

Salut A Vous, O Grand Manitou Emil Isberg !!

>   This message is in MIME format.  The first part should be readable text,

grrrrrr I hate MIME :-)

> /incoming/old/.../games/Red_alert/redalert.002 b _ i a guest ftp 0 *

Yes, I think this is a fix|feature|bug(pick any two :-).

the 'upload' directive will only take effect if root_dir match 
the passwd field, i.e. only the underlying Unix
file permissions will do the restrictions if they mismatch.

Let me cut and paste for you

FIXES-2.4.2-BETA-11:
....
 ftpaccess.5 now clarifies the fact that the root-dir specified in
 the upload configuration line MUST match the home directory in
 the operation system password database.

there was a discussion a year back with the 'nodirs problem'
and a patch provided by Bob Myers. But i think everything
was integrated in beta-12.

-- 
au revoir, alain
----
Teamwork is essential -- it allows you to blame someone else.

---

From: Andy Ellsworth <[email-masked]>
Date: Tue, 18 Mar 1997 13:16:08 -0600 (CST)

Something definitely changed in the interpretation of the 'nodirs'
directive between BETA-11 and BETA-12.  We installed BETA-12 here at
wuarchive, and about 3 weeks later I realized that the nodirs wasn't
working, as a bunch of software pirates had maxed out all of our drives :(

I switched back to BETA-11 and things work normally.  Anyone know what
changed for sure?

+----------------------------------------------------------------------------+
| Andy Ellsworth  |  [email-masked] |  Admin/Cyberdiplomat, Wuarchive    |
+----------------------------------------------------------------------------+

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Thu, 20 Mar 1997 09:42:04 +0100 (MET)

> I switched back to BETA-11 and things work normally.  Anyone know what

Well.. I haven't changed the config and I just tested it (I've been
bitten by the hidden incoming dir before). Making dirs is still rejected.

upload  /ftp/ftp        *       no
upload  /ftp/ftp        /pub/incoming   yes     root    daemon  0600    nodirs

$ ftp idefix
Connected to idefix.cetis.hvu.nl.
220 idefix.cetis.hvu.nl FTP server (Version wu-2.4.2-academ[BETA-12](1) Wed Feb 5 12:04:55 MET 1997) ready.

[..]

ftp> cd /pub/incoming
250 CWD command successful.
ftp> mkdir moof
530 moof: Permission denied. (Upload dirs)
ftp> cd /
250 CWD command successful.
ftp> mkdir /pub/incoming/moof
530 /pub/incoming/moof: Permission denied. (Upload dirs)

                                          Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Work)  <-- finger -l for PGPkey      Fax: +31-30-2586290
  [email-masked] (Home)                      Workphone: +31-30-2586287
  http://www.cetis.hvu.nl/~koos/   Looking for a license plate with "RFC 822"

---

From: "Steven K. Buehler" <[email-masked]>
Date: Thu, 20 Mar 1997 07:48:56 -0600

I changed the permissions on incoming to 777 and it worked fine.  The only problem that I am having is that I can't seem to get the owner and group to work.  Your example below says that any file that is uploaded will have the owner and group of root:daemon.  Mine always comes up as ftp:30000.  Got any suggestions?  I really need to be able to have that as something different.

>530 /pub/incoming/moof: Permission denied. (Upload dirs)

======================================================
Steven K. Buehler
S & B Computers
Rockford Illinois, USA
Phone: 815-398-7169
Fax: 815-398-7266
======================================================

---

From: Andy Ellsworth <[email-masked]>
Date: Wed, 19 Mar 1997 13:51:46 -0600 (CST)

> bitten by the hidden incoming dir before). Making dirs is still rejected.

[...]

Hmm...maybe we have an oddly configured ftpaccess file.  Anyhow I saw
Alain's post about the home dirs needing to match; that was probably the
problem.

Thanks for the response(s).